Security

Certifications will be listed here as they are obtained.

Customer data is hosted in the UK or EU, depending on requirements.

• Data encrypted in transit with TLS 1.2+ and at rest using full-disk encryption on servers and managed devices.
• Access control: role-based, principle of least privilege
• Multi-factor authentication enforced for all staff
• Audit logging on all systems

Personnel undergo identity and right-to-work checks. Baseline Personnel Security Standard (BPSS) checks available on request for contracts that require them.

Security incidents are reported within 24 hours of detection.

• Vulnerability disclosure: report to [email protected]
• security.txt

Updated when subprocessors change. Customers are notified of material changes.

Kyros Software Ltd is a UK-registered entity. Engineering is delivered by a distributed team.

Access to client data is restricted to named, approved personnel, protected by multi-factor authentication and a password manager, and removed at project end.